The EU's landmark AI Act, which took effect in August 2024, was designed to protect citizens while fostering innovation, but a critical gap in its research exemptions could inadvertently penalize the very scientists the law aimed to support. A new position paper from AI researchers argues that the Act's obligations may apply to far more research projects than policymakers realized, and that publishing findings on platforms like GitHub or Hugging Face could actually void the legal protections meant to shield academic work.

How Does the EU AI Act Actually Apply to Researchers?

The EU AI Act creates a risk-based framework that imposes compliance obligations on providers of AI systems, including documentation, testing, and monitoring requirements. The challenge is that the Act defines "AI systems" very broadly, in ways that don't align with how the research community actually works. When researchers combine AI models with other components like user interfaces, or when they release demos of their work, those projects can legally qualify as regulated AI systems under the Act.

This matters because major AI conferences like ICML, NeurIPS, and ICLR now require compliance with the EU AI Act in their research ethics guidelines. Researchers who publish their work at these venues could face the same compliance obligations as companies like Meta, Google, or Anthropic, including requirements for bias testing, audit trails, and detailed documentation. The potential penalty for non-compliance is severe: fines up to €35 million.

What makes this situation particularly problematic is the Act's extraterritorial reach. Even researchers working outside the European Union must comply if their AI systems operate in or target the EU market. This creates what legal scholars call the "Brussels effect," where EU regulations effectively become global standards.

Why Are Research Exemptions Failing to Protect Scientists?

The EU AI Act does include exceptions meant to protect scientific research, but these exceptions have a critical flaw: they don't account for how modern AI research is actually conducted. The Act's research exemptions are designed to protect work done in controlled laboratory settings, but they fail to address the current convention of publishing AI models and systems alongside academic papers on open platforms.

In other words, the moment a researcher publishes their work publicly, they may lose the legal protection that the research exemption was supposed to provide. This creates an impossible choice for scientists: either keep their research private and unpublished, or risk massive legal liability by sharing it with the academic community and the world.

The position paper identifies several practical examples of how this plays out. Researchers who release code, pre-trained models, or interactive demos as part of their published work could be classified as "providers" of AI systems under the Act, triggering all the compliance obligations that apply to commercial AI developers.

Steps Researchers Can Take to Navigate the Legal Uncertainty

• Conduct a Legal Assessment: Researchers should first evaluate whether their work involves an AI system or model regulated by the EU AI Act, and whether their actions qualify them as providers of that system. The position paper provides a roadmap to help researchers make this determination.
• Document Compliance Efforts: Even when research exemptions may apply, maintaining detailed documentation of testing, bias evaluation, and safety measures can reduce legal risk and demonstrate good-faith compliance efforts.
• Engage with Institutional Support: Universities and research institutions should establish clear policies and provide legal guidance to researchers about EU AI Act compliance, rather than leaving individual scientists to navigate the law alone.
• Advocate for Regulatory Clarity: The research community should engage with policymakers and legal scholars to push for amendments that account for current AI research practices, particularly around model and system release conventions.

The position paper's authors argue that the current legal framework creates unintended obstacles for researchers who lack the time, budget, and expertise to meet the same compliance requirements as large technology companies. This threatens to disrupt established research practices and could slow scientific progress in AI development.

What Changes Are Experts Recommending?

The researchers behind the position paper propose two main categories of solutions. First, they recommend legislative changes to the EU AI Act itself, specifically amendments that would clarify how research exemptions apply to published work and model releases. Second, they suggest practical recommendations for researchers to reduce compliance risk, such as maintaining detailed audit trails and conducting bias testing even when not strictly required.

Meanwhile, enterprises are already grappling with EU AI Act compliance at scale. Microsoft and consulting firms are developing comprehensive governance frameworks that map the Act's four risk tiers to specific organizational controls. These frameworks typically include strategies for classifying AI use cases, enforcing approved tool lists, implementing human-in-the-loop requirements for high-risk systems, and maintaining board-level reporting on compliance status.

The European Commission continues to refine its approach to AI governance. In July 2026, the Commission presented an Action Plan addressing how advanced AI models can support cybersecurity, signaling that regulatory evolution is ongoing. This suggests that policymakers are aware of implementation challenges and may be open to clarifications that better serve the research community.

The core issue remains unresolved: the EU AI Act was written with the best intentions to protect citizens and foster trustworthy AI, but its current language creates a legal minefield for the academic researchers who are fundamental to advancing the field. Without clarification or amendment, the law risks achieving the opposite of its stated goal, potentially chilling innovation and slowing the development of safer, more trustworthy AI systems.